In internetworking and computer network engineering, Request for Comments (RFC) documents are a series of memoranda encompassing new research, innovations, and methodologies applicable to Internet technologies. The Internet Engineering Task Force (IETF) adopts some of the proposals published in RFCs as Internet standards.
The simple network management protocol (SNMP) forms part of the internet protocol suite as defined by the Internet Engineering Task Force (IETF). More specifically, the simple network management protocol (SNMP) is a Layer 7 or Application Layer protocol used by network management systems for monitoring network-attached devices (sometimes called network elements (NEs) or Agents) for conditions that warrant administrative attention. SNMP can be used between a Manager Station (MS) and NEs to manage the NEs. The first Request for Comments (RFCs) for SNMP, now known as Simple Network Management Protocol version 1 (SNMP v1), were criticized for inadequate security. In these RFCs, authentication of clients is performed only by a “community string,” in effect a type of password, which is transmitted in cleartext.
More recently, the IETF has recognized Simple Network Management Protocol version 3 (SNMP v3), as defined by RFC 3411-RFC 3418 (also known as STD0062), as the current standard version of SNMP. The official source for RFCs on the World Wide Web is the RFC Editor. One may retrieve almost any individual, published RFC via the following URL: http://www.rfc-editor.org/rfc. In practice, SNMP implementations often support multiple versions: typically SNMPv1, SNMPv2c, and SNMPv3. See RFC 3584 “Coexistence between Version 1, Version 2, and Version 3 of the Internet-standard Network Management Framework.”
RFC 3414 defines a SNMPv3 User-based Security Model (USM). RFC 3414 discusses how keys are to set up so that the manager station knows that it can trust a network element, and vice-versa. RFC 3414 states that the initial provisioning of authentication keys and privacy or encryption keys are to be done via an “out-of-band mechanism.” This mechanism is not defined within the RFC. However, the “out-of-band mechanism” supported by some third party management platforms as well as some SNMP toolkits for initial provisioning of authentication and privacy keys is manually input by an operator.
FIG. 1 is a message flow diagram showing an exemplary network architecture and a message flow and processing 100 for configuring SNMPv3 authentication and privacy keys for use between a Manager Station 120 and an Agent Station 140 which communicate over a communication link 130.
The Agent Station 140 may comprise any network element (NE) including, for example, a master agent or subagent. A master agent is a piece of software running on an SNMP-capable network component that responds to SNMP requests from the management station. A master agent relies on subagents to provide information about the management of specific functionality. A subagent is a piece of software running on an SNMP-capable network component that implements the information and management functionality defined by a specific Management Information Base (MIB) of a specific subsystem, for example, the Ethernet link layer. Some capabilities of the subagent include gathering information from master agents, configuring parameters of the master agents, responding to managers' requests, and generating alarms or traps.
The Manager Station 120 may comprise any type of management station, and can issue requests for management operations on behalf of an administrator or application and receives traps from agents as well.
According to the approach shown in FIG. 1, as shown by arrow 160, an administrator would manually enter initial keys (e.g., pass-phrase strings corresponding to the initial SNMPv3 authentication keys and initial SNMPv3 privacy keys) at the Manager Station 120, and as shown by arrow 170, a technician installing equipment would manually enter initial keys at the Agent Station 140. For example, in most cases, the administrator informs the technician via phone, etc. of what the initial key is. If there is a communication error between the administrator and the technician such that the technician enters the wrong key, then the configuration process will fail since the keys entered at the Manager Station 120 and Agent Station 140 must be identical. At arrow 180, the new SNMPv3 authentication and privacy keys can then be used by the Manager Station 120 and the Agent Station 140 during secure SNMPv3 communications.
Skilled artisans will appreciate that elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. For example, the dimensions of some of the elements in the figures may be exaggerated relative to other elements to help to improve understanding of embodiments of the present invention.